IRS Spoofing for Mal-ware

Remember, anyone can say they are sending mail from any address.  Of course, the misspelling of “submission” and a lack of understanding what a W-2 doesn’t help their cause …

From: Internal Revenue Service []
Subject: W-2 form update
Attachments: w2form.doc (88 KB)

We would like to inform you that as of the 16th of June
you are late in updating your W-2 form submition with the new updated version. Please send us your completed W-2 update form by 01/07/2010. The updated version of the W-2 form is attached to this message.

Internal Revenue Service

 And then you open it (the Word document itself is harmless):

But the object itself, actually named “Copy of p5020.exe” is the virus / mal-ware.